Merge release-23.05 into staging-next-23.05

2026-10-02 04:50:21 +00:00 · 2023-09-28 00:12:43 +00:00
parent e4fc2f7fa5 c9ac6ec013
commit a9f401f5fe
18 changed files with 73 additions and 59 deletions
--- a/doc/stdenv/stdenv.chapter.md
+++ b/doc/stdenv/stdenv.chapter.md
@@ -1445,7 +1445,7 @@ This flag can break dynamic shared object loading. For instance, the module syst

 #### `bindnow` {#bindnow}

-Adds the `-z bindnow` linker option. During program load, all dynamic symbols are resolved, allowing for the complete GOT to be marked read-only (due to `relro`). This prevents GOT overwrite attacks. For very large applications, this can incur some performance loss during initial load while symbols are resolved, but this shouldn’t be an issue for daemons.
+Adds the `-z now` linker option. During program load, all dynamic symbols are resolved, allowing for the complete GOT to be marked read-only (due to `relro`). This prevents GOT overwrite attacks. For very large applications, this can incur some performance loss during initial load while symbols are resolved, but this shouldn’t be an issue for daemons.

 This flag can break dynamic shared object loading. For instance, the module systems of Xorg and PHP are incompatible with this flag. Programs incompatible with this flag often fail at runtime due to missing symbols, like:

--- a/nixos/modules/services/misc/dysnomia.nix
+++ b/nixos/modules/services/misc/dysnomia.nix
@@ -223,7 +223,7 @@ in
      ejabberdUser = config.services.ejabberd.user;
    }; }
    // lib.optionalAttrs (config.services.mysql.enable) { mysql-database = {
-        mysqlPort = config.services.mysql.port;
+        mysqlPort = config.services.mysql.settings.mysqld.port;
        mysqlSocket = "/run/mysqld/mysqld.sock";
      } // lib.optionalAttrs cfg.enableAuthentication {
        mysqlUsername = "root";
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -30,6 +30,7 @@
 , Foundation
 , testers
 , imagemagick
+, perlPackages
 , python3
 }:

@@ -47,13 +48,13 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "imagemagick";
-  version = "7.1.1-15";
+  version = "7.1.1-18";

  src = fetchFromGitHub {
    owner = "ImageMagick";
    repo = "ImageMagick";
    rev = finalAttrs.version;
-    hash = "sha256-/fI/RrwcgvKX5loIrDAur60VF5O4FgyPYN7BbcPP/bU=";
+    hash = "sha256-DnmX4dxpOqDGHOFSnq7ms2fLGdB1nKdZbpd0Q9t+X6A=";
  };

  outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big
@@ -125,12 +126,14 @@ stdenv.mkDerivation (finalAttrs: {

  passthru.tests = {
    version = testers.testVersion { package = finalAttrs.finalPackage; };
+    inherit (perlPackages) ImageMagick;
    inherit (python3.pkgs) img2pdf;
    pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
  };

  meta = with lib; {
    homepage = "http://www.imagemagick.org/";
+    changelog = "https://github.com/ImageMagick/Website/blob/main/ChangeLog.md";
    description = "A software suite to create, edit, compose, or convert bitmap images";
    pkgConfigModules = [ "ImageMagick" "MagickWand" ];
    platforms = platforms.linux ++ platforms.darwin;
--- a/pkgs/applications/misc/zola/default.nix
+++ b/pkgs/applications/misc/zola/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , rustPlatform
 , cmake
 , pkg-config
@@ -26,6 +27,14 @@ rustPlatform.buildRustPackage rec {

  cargoHash = "sha256-AAub8UwAvX3zNX+SM/T9biyNxFTgfqUQG/MUGfwWuno=";

+  patches = [
+    (fetchpatch {
+      name = "CVE-2023-40274.patch";
+      url = "https://github.com/getzola/zola/commit/fe1967fb0fe063b1cee1ad48820870ab2ecc0e5b.patch";
+      hash = "sha256-B/SVGhVX5hAbvMhBYO+mU5+xdZXU2JyS4uKmOj+aZuI=";
+    })
+  ];
+
  nativeBuildInputs = [
    cmake
    pkg-config
--- a/pkgs/applications/networking/browsers/librewolf/librewolf.nix
+++ b/pkgs/applications/networking/browsers/librewolf/librewolf.nix
@@ -29,9 +29,9 @@ rec {
    sed -i '/MOZ_NORMANDY/ s/True/False/' browser/moz.configure
  '';

-  extraPrefsFiles = [ "${source}/submodules/settings/librewolf.cfg" ];
+  extraPrefsFiles = [ "${src.settings}/librewolf.cfg" ];

-  extraPoliciesFiles = [ "${source}/submodules/settings/distribution/policies.json" ];
+  extraPoliciesFiles = [ "${src.settings}/distribution/policies.json" ];

  extraPassthru = {
    librewolf = { inherit src extraPatches; };
--- a/pkgs/applications/networking/browsers/librewolf/src.json
+++ b/pkgs/applications/networking/browsers/librewolf/src.json
@@ -1,11 +1,15 @@
 {
-  "packageVersion": "116.0.2-1",
+  "packageVersion": "117.0.1-1",
  "source": {
-    "rev": "116.0.2-1",
-    "sha256": "08q50yjb8q168zb2y4iajjqd9ygbpywwr9i4vfn67wchqlsc1mrp"
+    "rev": "117.0.1-1",
+    "sha256": "06j85b6v54vxj99hgrlibpsg6f8w8cqj912vz7gwyfa17pawax9z"
+  },
+  "settings": {
+    "rev": "9c862f06f970d69e00c1035e0d4774fb44fd84a6",
+    "sha256": "0ay58wrhfn0b56748phpn0ahz11ls9y8d2fd1z4zrj6dv398vlmb"
  },
  "firefox": {
-    "version": "116.0.2",
-    "sha512": "2c0ae18672fe22c75002744831130e13da764f83726951e5b58cfe74f7f473e22634ce08ebc11a98bac5baec0a4ac099a3a350a8b756af9c5bea6d5f4432da6d"
+    "version": "117.0.1",
+    "sha512": "1583b0ad3b3b17c59bfbfb3e416074766327d0b926ef4f6c6b1e3b2d7cf6a18dec592b7d17fab9493ba1506f3540a02277096d28616dd29b6e7b9e93905f2071"
  }
 }
--- a/pkgs/applications/networking/browsers/librewolf/src.nix
+++ b/pkgs/applications/networking/browsers/librewolf/src.nix
@@ -1,4 +1,4 @@
-{ lib, fetchurl, fetchFromGitLab }:
+{ lib, fetchurl, fetchFromGitLab, fetchFromGitea }:
 let src = lib.importJSON ./src.json;
 in
 {
@@ -9,6 +9,12 @@ in
    fetchSubmodules = true;
    inherit (src.source) rev sha256;
  };
+  settings = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "librewolf";
+    repo = "settings";
+    inherit (src.settings) rev sha256;
+  };
  firefox = fetchurl {
    url =
      "mirror://mozilla/firefox/releases/${src.firefox.version}/source/firefox-${src.firefox.version}.source.tar.xz";
--- a/pkgs/applications/networking/browsers/librewolf/update.nix
+++ b/pkgs/applications/networking/browsers/librewolf/update.nix
@@ -57,9 +57,18 @@ writeScript "update-librewolf" ''
  ffHash=$(grep '\.source\.tar\.xz$' "$HOME"/shasums | grep '^[^ ]*' -o)
  echo "ffHash=$ffHash"

+  # upstream does not specify settings rev, so just get the latest. see https://github.com/NixOS/nixpkgs/issues/252276
+  settingsRev=$(curl 'https://codeberg.org/api/v1/repos/librewolf/settings/commits?sha=master&limit=1' | jq -r .[0].sha)
+  echo "settingsRev=$settingsRev"
+  repoUrl=https://codeberg.org/librewolf/settings
+  nix-prefetch-git $repoUrl --quiet --rev $settingsRev > $prefetchOut
+  settingsSha256=$(jq -r .sha256 < $prefetchOut)
+
  jq ".source.rev = \"$latestTag\"" $srcJson | sponge $srcJson
  jq ".source.sha256 = \"$srcHash\"" $srcJson | sponge $srcJson
  jq ".firefox.version = \"$ffVersion\"" $srcJson | sponge $srcJson
  jq ".firefox.sha512 = \"$ffHash\"" $srcJson | sponge $srcJson
  jq ".packageVersion = \"$lwVersion\"" $srcJson | sponge $srcJson
+  jq ".settings.rev = \"$settingsRev\"" $srcJson | sponge $srcJson
+  jq ".settings.sha256 = \"$settingsSha256\"" $srcJson | sponge $srcJson
 ''
--- a/pkgs/applications/networking/browsers/mullvad-browser/default.nix
+++ b/pkgs/applications/networking/browsers/mullvad-browser/default.nix
@@ -78,7 +78,7 @@ let
      ++ lib.optionals mediaSupport [ ffmpeg ]
  );

-  version = "12.5.4";
+  version = "12.5.5";

  sources = {
    x86_64-linux = fetchurl {
@@ -86,7 +86,7 @@ let
        "https://cdn.mullvad.net/browser/${version}/mullvad-browser-linux64-${version}_ALL.tar.xz"
        "https://github.com/mullvad/mullvad-browser/releases/download/${version}/mullvad-browser-linux64-${version}_ALL.tar.xz"
      ];
-      hash = "sha256-xjCsCg6XsnXAiNw6frgJVZRV9UBZA2EAcuHa2Bjq/ro=";
+      hash = "sha256-ISmhKitFReHSADGygzpoKwlBOJH2HfPDEtMjTB6fMhs=";
    };
  };

--- a/pkgs/applications/networking/browsers/palemoon/bin.nix
+++ b/pkgs/applications/networking/browsers/palemoon/bin.nix
@@ -17,19 +17,19 @@
 , palemoon-bin
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "palemoon-bin";
-  version = "32.3.1";
+  version = "32.4.0.1";

  src = fetchzip {
    urls = [
-      "https://rm-eu.palemoon.org/release/palemoon-${version}.linux-x86_64-gtk${if withGTK3 then "3" else "2"}.tar.xz"
-      "https://rm-us.palemoon.org/release/palemoon-${version}.linux-x86_64-gtk${if withGTK3 then "3" else "2"}.tar.xz"
+      "https://rm-eu.palemoon.org/release/palemoon-${finalAttrs.version}.linux-x86_64-gtk${if withGTK3 then "3" else "2"}.tar.xz"
+      "https://rm-us.palemoon.org/release/palemoon-${finalAttrs.version}.linux-x86_64-gtk${if withGTK3 then "3" else "2"}.tar.xz"
    ];
    hash = if withGTK3 then
-      "sha256-1JYaxxkqgg/gLdZ+uGDB5BI0NKjHO4huk0b/M9QFuII="
+      "sha256-kGt3pIgCjVeSD6UXRvj5w9opWrMx3q3B/Y0S55kKS08="
    else
-      "sha256-p/Lid6Uv3XTEg+43Gke5VLILhzENHoBP6XjGVHy7wCY=";
+      "sha256-kNvUC/ir7TKjvKXYFoEDOPAY75CEgeixmEV1tuB/WIM=";
  };

  preferLocalBuild = true;
@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
  ];

  desktopItems = [(makeDesktopItem rec {
-    name = pname;
+    name = "palemoon-bin";
    desktopName = "Pale Moon Web Browser";
    comment = "Browse the World Wide Web";
    keywords = [
@@ -164,6 +164,7 @@ stdenv.mkDerivation rec {
    longDescription = ''
      Pale Moon is an Open Source, Goanna-based web browser focusing on
      efficiency and customization.
+
      Pale Moon offers you a browsing experience in a browser completely built
      from its own, independently developed source that has been forked off from
      Firefox/Mozilla code a number of years ago, with carefully selected
@@ -186,4 +187,4 @@ stdenv.mkDerivation rec {
    platforms = [ "x86_64-linux" ];
    hydraPlatforms = [];
  };
-}
+})
--- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
@@ -92,7 +92,7 @@ lib.warnIf (useHardenedMalloc != null)
  fteLibPath = lib.makeLibraryPath [ stdenv.cc.cc gmp ];

  # Upstream source
-  version = "12.5.4";
+  version = "12.5.5";

  lang = "ALL";

@@ -104,7 +104,7 @@ lib.warnIf (useHardenedMalloc != null)
        "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
        "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
      ];
-      hash = "sha256-AIwqIz8QG7Fq3Vvd22QTNFH1fnZgtH25qUaECX50QCQ=";
+      hash = "sha256-FS1ywm/UJDZiSYPf0WHikoX/o6WGIP+lQQGFeD0g2dc=";
    };

    i686-linux = fetchurl {
@@ -114,7 +114,7 @@ lib.warnIf (useHardenedMalloc != null)
        "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
        "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
      ];
-      hash = "sha256-s8UReyurIKlxG0bT0ecGUcXMTTHyYKy/AcygTE6ujqo=";
+      hash = "sha256-6ozGIQPC8QnZxS1oJ0ZEdZDMY2JkwRHs+7ZHUkqrL6U=";
    };
  };

--- a/pkgs/applications/networking/instant-messengers/caprine-bin/default.nix
+++ b/pkgs/applications/networking/instant-messengers/caprine-bin/default.nix
@@ -1,7 +1,7 @@
 { lib, callPackage, stdenvNoCC }:
 let
  pname = "caprine";
-  version = "2.55.5";
+  version = "2.58.3";
  metaCommon = with lib; {
    description = "An elegant Facebook Messenger desktop app";
    homepage = "https://sindresorhus.com/caprine";
@@ -10,11 +10,11 @@ let
  };
  x86_64-appimage = callPackage ./build-from-appimage.nix {
    inherit pname version metaCommon;
-    sha256 = "MMbyiLBrdMGENRq493XzkcsDoXr3Aq3rXAni1egkPbo=";
+    sha256 = "sha256-w0nBQhHYzFLsNu0MxWhoju6fh4JpAKC7MWWVxwDkRYk=";
  };
  x86_64-dmg = callPackage ./build-from-dmg.nix {
    inherit pname version metaCommon;
-    sha256 = "1txuSQk6tH0xsjPk5cWUVnaAw4XBOr1+Fel06NLKFfk=";
+    sha256 = "sha256-6Mx2ZkT2hdnaSVt2hKMMV9xc7rYPFFbxcj6vb84ojYU=";
  };
 in
 (if stdenvNoCC.isDarwin then x86_64-dmg else x86_64-appimage).overrideAttrs (oldAttrs: {
--- a/pkgs/servers/web-apps/wallabag/default.nix
+++ b/pkgs/servers/web-apps/wallabag/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchurl
-, fetchpatch
 }:

 # Point the environment variable $WALLABAG_DATA to a data directory
@@ -16,30 +15,19 @@

 let
  pname = "wallabag";
-  version = "2.5.4";
+  version = "2.6.6";
 in
 stdenv.mkDerivation {
  inherit pname version;

  # Release tarball includes vendored files
  src = fetchurl {
-    urls = [
-      "https://static.wallabag.org/releases/wallabag-release-${version}.tar.gz"
-      "https://github.com/wallabag/wallabag/releases/download/${version}/wallabag-${version}.tar.gz"
-    ];
-    hash = "sha256-yVMQXjGB8Yv1klQaHEbDGMZmOtANRocFJnawKn10xhg=";
+    url = "https://github.com/wallabag/wallabag/releases/download/${version}/wallabag-${version}.tar.gz";
+    hash = "sha256-0CkJFSHPnOz333+7uMUqXI3A9dsA9FchZXXmwq7F09o=";
  };

  patches = [
    ./wallabag-data.patch # exposes $WALLABAG_DATA
-
-    # Use sendmail from php.ini instead of FHS path.
-    (fetchpatch {
-      url = "https://github.com/symfony/swiftmailer-bundle/commit/31a4fed8f621f141ba70cb42ffb8f73184995f4c.patch";
-      stripLen = 1;
-      extraPrefix = "vendor/symfony/swiftmailer-bundle/";
-      sha256 = "rxHiGhKFd/ZWnIfTt6omFLLoNFlyxOYNCHIv/UtxCho=";
-    })
  ];

  dontBuild = true;
--- a/pkgs/servers/web-apps/wallabag/wallabag-data.patch
+++ b/pkgs/servers/web-apps/wallabag/wallabag-data.patch
@@ -1,9 +1,9 @@
 diff --git a/app/AppKernel.php b/app/AppKernel.php
-index 347197e..902b558 100644
+index 61b734e06..d25d1aaa3 100644
 --- a/app/AppKernel.php
 +++ b/app/AppKernel.php
-@@ -69,19 +69,24 @@ class AppKernel extends Kernel
-         return __DIR__;
+@@ -62,14 +62,19 @@ class AppKernel extends Kernel
+         return $bundles;
     }
 
 +    public function getProjectDir()
@@ -24,9 +24,3 @@ index 347197e..902b558 100644
     }
 
     public function registerContainerConfiguration(LoaderInterface $loader)
-     {
-        $loader->load($this->getRootDir() . '/config/config_' . $this->getEnvironment() . '.yml');
-+        $loader->load($this->getProjectDir() . '/app/config/config_' . $this->getEnvironment() . '.yml');
- 
-         $loader->load(function ($container) {
-             if ($container->getParameter('use_webpack_dev_server')) {
--- a/pkgs/tools/package-management/disnix/disnixos/default.nix
+++ b/pkgs/tools/package-management/disnix/disnixos/default.nix
@@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "disnixos";
-  version = "0.9.3";
+  version = "0.9.4";

  src = fetchurl {
    url = "https://github.com/svanderburg/disnixos/releases/download/${pname}-${version}/${pname}-${version}.tar.gz";
-    sha256 = "0nm7g184xh6xzjz4a40a7kgfnpmq043x6v0cynpffa6wd9jv89s9";
+    sha256 = "0adv6dm6hszjhzkfkw48pmi37zj32plcibk80r6bm907mm7n50lj";
  };

  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/tools/package-management/disnix/dysnomia/default.nix
+++ b/pkgs/tools/package-management/disnix/dysnomia/default.nix
@@ -40,10 +40,10 @@ assert enableXinetdService -> xinetd != null;

 stdenv.mkDerivation rec {
  pname = "dysnomia";
-  version = "0.10.1";
+  version = "0.10.2";
  src = fetchurl {
    url = "https://github.com/svanderburg/dysnomia/releases/download/dysnomia-${version}/dysnomia-${version}.tar.gz";
-    sha256 = "0w9601g8zpaxrmynx6mh8zz85ldpb8psp7cc6ls8v3srjpj1l5n3";
+    sha256 = "08ijqbijs2h584dvsb3z858ha385fqd5jfxc51lks9lxxv0sfkr4";
  };

  configureFlags = [
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -39427,7 +39427,7 @@ with pkgs;
  disnix = callPackage ../tools/package-management/disnix { };

  dysnomia = callPackage ../tools/package-management/disnix/dysnomia (config.disnix or {
-    inherit (python2Packages) supervisor;
+    inherit (python3Packages) supervisor;
  });

  dydisnix = callPackage ../tools/package-management/disnix/dydisnix { };
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -19603,10 +19603,10 @@ with self; {
  PerlMagick = ImageMagick; # added 2021-08-02
  ImageMagick = buildPerlPackage rec {
    pname = "Image-Magick";
-    version = "7.1.0-0";
+    version = "7.1.1-18";
    src = fetchurl {
      url = "mirror://cpan/authors/id/J/JC/JCRISTY/Image-Magick-${version}.tar.gz";
-      hash = "sha256-+QyXXL4hRFd3xA0ZwXt/eQI9MGTvj6vPNIz4JlS8Fus=";
+      hash = "sha256-42mvGP4FkY/YfPOh/jRiUFWdDk+S2oB0Jfqv30AAlxw=";
    };
    buildInputs = [ pkgs.imagemagick ];
    preConfigure =